Many systems have been established in an enterprise to allow information and knowledge to be shared, and as a consequence, distribution of documents has been briskly made. Since late 1990s when doing the Internet started to become an everyday activity, enterprises have been making an enormous investment on security in order to prevent the external leakage of the crucial company information by outside hackers.
However, the information leakage out of the company is mostly due to the carelessness or design of an insider. Accordingly, an insider threat management (“ITM”) is necessary to prevent the information leakage by insiders.
Methods such as Blocking, Content Filtering, and Logging have been attempted as technical methods for the ITM. However, Blocking has a problem in that it is difficult to prevent the intentional leakage, Content Filtering has a problem in that the system capacity may be lowered and it is difficult to perform exact filtering, and Logging has a limitation of not being capable of preventing the leakage in advance as it is a postmeasure.
Recently, EDRM (Enterprise DRM) using DRM (Digital Right Management) developed to protect the copyright of content draws attention as an appropriate solution to a document security method in the enterprise, and therefore, is introduced by many advanced companies.
The basic concept of DRM is to restrict the use of contents, documents, files, and the like according to a copy right holder's intention, and this encrypts and transfers contents and defines how the contents should be used.
DRM may be classified into Consumer DRM (CDRM) and Enterprise DRM (EDRM). CDRM primarily focuses on the copyright protection of contents whereas EDRM primarily focuses on document security of a company.
EDRM maintains document security by constantly controlling users, use environments, and functions with respect to use of in-house documents.
The sub module of an EDRM product is mainly composed of a policy server that determines a security policy, a license server that issues a license, and a DRM client. The DRM client plays an important role, that is, the DRM client decrypts an encrypted file, transfers the decrypted file to a rendering application, and allows the file to be used only within a predetermined range to block the information leakage path.
A technology of realizing the DRM client may be classified into three methods, such as Embedding, Plug-in, and Overriding.
Embedding is a method of implementing DRM functions directly in source codes of the rendering application, and this is easiest to implement and has a high security level. However, Embedding has a restriction in that this may be applicable only in case of being capable of fixing the source codes.
Plug-in is a method of restricting the use of the rendering application by using APis provided from the rendering application. This has a limitation in its application since many of rendering applications do not provide the APis, and may have a weakness in security because of using public APis.
Overriding is a method of changing the execution codes of the rendering application at runtime in a memory, and this is also referred to as “Hooking” or “API Hooking”. Although having many difficulties in implementation, this method has advantages of being capable of controlling any rendering applications and having superior security, and therefore, is partially or fully employed by numerous DRM vendors.
The API Hooking technology may be applied to both a user level and a kernel level of an operating system, wherein the user level is mainly used. Although various methods are included in the user level API Hooking, two types of methods, such as an IAT alteration method that alters an execution binary IAT (Import Address Table) and a code overwriting method that alters an execution binary code, are used the most because of being capable of most efficiently supporting functions required for the DRM client module.
However, as the EDRM is spread to companies, EDRMs from various DRM vendors happened to apply to a company. As DRM client modules from various DRM vendors, which have been developed by using an API Hooking technology, are installed in a single PC, a crash may occur, and this may cause it impossible to read encrypted documents, malfunction or abnormal end of an application program, malfunction of an operating system, or lowering in speed.
The above-mentioned crash takes place because of the following reasons.
The API Hooking technology such as the IA T alteration method and the code overwriting method is based on a variation of an API call path. That is, the operation of an application program is controlled by manipulating parameters and return values of an API that is called by changing and detouring a specific API call path in the call relationship between modules which belongs to the application program, and arranging the DRM client module in the detoured path.
The address value of the API to be called should be varied to change the API call path. However, a series of processes are performed as follows in the course of loading the process of an application program under control if DRM client modules from two or more different DRM vendors are installed and operated.
(1) Activation of an application process
(2) Loading of system DLL and custom DLL required for application
(3) Loading or insertion of DRM client module
(4) Alteration of API call path of modules, by DRM client modules, loaded in the corresponding application process region.
A process that each DRM client module of each DRM vendor changes an API call address value of the same specific module into its own specific function is performed in the process (4) among the above-mentioned processes, and this process is sequentially done in an order of loading each DRM client module of each DRM vendor on the application program process region. The API call address value changed with the result of the process (4) is variable according to the loading order of each DRM client of each DRM vendor and the API call address change and management method of each DRM client module. This result may lead to various problems as in Table 1.
TABLE 1Result of API call address change DProblems caused D(1) module loaded the latest is set to DRM client module loaded first ishave changed address value (in case excluded from API call path not that module loaded first changes to be capable of controlling API call address values and then application program and thus may changed address memory region not open document encrypted in is not managed)the format of the corresponding module vendor.(2) address value changed by moduleDRM client module loaded later loaded first is set (in case that modulemay not be able to alter API call loaded first changes API call addresspath not to be capable of values and then the whole changed controlling application program API call address values are adapted and thus may not open document not to be changed by another module)encrypted in the format of the corresponding module vendor(3) function address values changed by* impossible to read encrypted module loaded first and module loadedEDRM documents* malfunction later are mixed (in case that moduleor abnormal end of application loaded first changes API call addressprograms* malfunction or values and then only some of API calllowering in speed of operating address values are applied not to besystemschanged by another module)
In incidence of the above-mentioned crash, case (3) in Table 1 causes the most serious problem, the cause of which is as follows.
A few tens of APIs are used when an application program performs one operation such as “reading document”, and the number of calls of the APis, although varying as the case may be, reaches a few hundreds or a few thousands. Expected parameters and return values are transferred according to a predetermined order in the course of these series of calls, so that the operation may be processed normally.
However, multiple API call address values used for an application program are mixed and varied with function address values of DRM client modules from different vendors in case (3) in Table 1, and therefore, the series of API calls that come with one operation are done between DRM client modules from different vendors that are implemented in different methods and logics, resulting in the failure of some API calls and entrance into unexpected addresses or return of unexpected parameters and result values. Therefore, any application program that is not well equipped with an exception process device in this case may give rise to a malfunction or abnormal end. In addition, incidence of the malfunction of the application program in the course of interfacing with an operating system through IPC (Inter-process Communication) may have an effect on the function of the operating system, thus leading to a malfunction of the system or lowering in speed.
As a result, it can be seen that a crash occurring when the DRM clients from various DRM vendors simultaneously operate in a single PC comes from a fact that each DRM client module employs the same technology to control the same application program process at the same time. Making only one DRM client operate when the application program process is operated, that is, making only one DRM client agent program driving and managing the DRM client operate at one time, may be considered most easily as a method to escape from such a crash. This may be done by a method of initiating and ending the DRM client agent program of each DRM vendor through a GUI (Graphical User Interface).
This is the method that was attempted two or three years ago when a crash between DRM clients were firstly issued in the domestic information security industries that commercialized and encouraged DRM solutions for the first time in the world, and this method was called “DRM agent manual switch”. This method could be applied without any other additive adverse effects or problems. However, this method was not welcome by end users because of inconvenience in use that users should select and drive a DRM client agent of the vendor beforehand to read an encrypted document in the format of a specific DRM vendor and it is impossible to simultaneously read encrypted documents from various DRM vendors, and therefore, use rate of EDRM system was decreased, thus leading to a request of a further advanced method for crash avoidance.
This request created a further improved type of a crash avoidance method, in which a predetermined Active DRM vendor is set while the DRM client agents from various DRM vendors are operated at the same time and the format of a document is identified and processed at the time of a user reading the document. This method has a meaning in terms of removal of user's inconvenience because of not requiring user's additive work prior to reading of the document.
This may activate the Active DRM client to allow the document to be read without any other additive work if the document that the user attempts to read is made in the format of the current Active DRM vendor. If the document that the user attempts to read is made in the format of DRM vendors other than the Active DRM vendor, the DRM client module from the Active DRM vendor changes the other DRM vendors to be in the Active state, and then shows the user an appropriate message to induce the user to reattempt to read the document. At this time, if the user attempts to read the document again, the format of the document conforms to the Active DRM vendor, so that the user may read the document. This method is called “DRM agent semiautomatic switch”.
However, the above-mentioned method has some inconveniences in that the DRM client from each vendor should be redistributed by adding a corresponding function with the aid of each DRM vendor used and document reading should be attempted after the application program is ended in a case where the format of the document that the user attempts to read does not conform to the preset Active DRM vendor, and encrypted documents from various DRM vendors are still impossible to read at the same time like in the conventional methods.
A number of different methods were designed and attempted to solve the above problems and inconveniences, one of which is directed to a method of separating and executing a process of an application program. This process separation method, which identifies the format of a document at the time of reading the document to separate and generate the process instance for each and every DRM vendor, was evaluated as a more advanced method than existing switch methods, for example, in view of being capable of reading documents from various DRM vendors at the same time. However, this method is known not to have been commercialized because of being not capable of applying to application programs that cannot create two or more process instances, having a difficulty in a process when various functions (Copy&Paste, OLE object insertion, etc.) operate using an IPC between application program processes during which documents from different DRM vendors are opened, and not guaranteeing the safety.